PT-2018-1893 · Mercurial+4 · Mercurial+4

Published 2018-03-14 · Updated 2024-06-15 · CVE-2018-1000132

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mercurial versions prior to 4.5.1

Description The issue is related to incorrect access control in the protocol server, which can lead to unauthorized data access. This can be exploited via network connectivity, potentially allowing a remote attacker to compromise data confidentiality and integrity.

Recommendations For Mercurial versions prior to 4.5.1, update to version 4.5.1 or later to resolve the issue. As a temporary workaround, consider restricting network connectivity to the protocol server until the update can be applied.

Fix

Incorrect Permission

Improper Access Control

Weakness Enumeration

CWE-732

CWE-284

Related Identifiers

ALT-PU-2018-2508

BDU:2018-01497

CESA-2019_2276

CVE-2018-1000132

DLA-1331-1

DLA-1414-1

DLA-2293-1

GHSA-4MR4-7VJV-9HM6

MGASA-2018-0355

OPENSUSE-SU-2024:10586-1

PYSEC-2018-87

RHSA-2019:2276

RHSA-2019_2276

SUSE-SU-2018:0933-1

SUSE-SU-2018_0933-1

Affected Products

Alt Linux

Centos

Mercurial

Red Hat

Suse

References · 40

• https://ubuntu.com/security/CVE-2018-1000132 · Vendor Advisory
• https://mercurial-scm.org/wiki/WhatsNew#Mercurial_4.5.1_.2F_4.5.2_.282018-03-06.29 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1000132 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-1000132 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0355.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000132 · Security Note
• https://osv.dev/vulnerability/DLA-2293-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1000132 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10586-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:0933-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2018-87 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000132 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1414-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1000132 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01497 · Security Note